Week 6. BoardLight
TL;DR
This is an Ubuntu 20.04 machine running a version of Dolibarr which is vulnerable to PHP injection (CVE-2023-30253). This is exploited to get an initial foothold, then we find a credential to move laterally to a low-privileged user and retrieve the user flag. Regarding escalation, we abuse a vulnerable installed Enlightenment version (CVE-2022-37706).
KEYWORDS
Dolibarr, CVE-2023-30253, PHP injection, SUID files, Enlightenment, CVE-2022-37706.
REFERENCES
https://www.dolibarr.org/forum/t/login-after-installation/16088
https://www.cvedetails.com/cve/CVE-2023-30253
https://www.cvedetails.com/cve/CVE-2022-37706
https://www.exploit-db.com/exploits/51180
ENUMERATION
Port scan.
> nmap $target -p- --min-rate=5000 -Pn --open --reason
Starting Nmap 7.93 ( https://nmap.org ) at 2024-08-30 07:23 EDT
Nmap scan report for 10.10.11.11
Host is up, received user-set (0.037s latency).
Not shown: 63419 closed tcp ports (conn-refused), 2114 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT STATE SERVICE REASON
22/tcp open ssh syn-ack
80/tcp open http syn-ack
Nmap done: 1 IP address (1 host up) scanned in 13.56 secondsEnumerate the open ports.
Enumerate the web site with Firefox, take note of the domain name.
Add to hosts file and fuzz for subdomains.
Add the found subdomain to hosts file and enumerate it with Firefox.
A Dolibarr welcome page pops-up. This is an open source ERP and CRM for enterprises. The running version is 17.0.0.
USER
We find Dolibarr default credentials doing an online search (https://www.dolibarr.org/forum/t/login-after-installation/16088). Log in as admin:admin, and navigate to the "Websites" section, where you can create and publish sites. This feature is vulnerable to PHP injection allowing filters to be bypassed. More info here: https://www.cvedetails.com/cve/CVE-2023-30253
Click on "Websites" tab and then in "Add". Enter any name and click on "Create".
Next, add a new page, select "New page from scratch", enter any title and click on "Create".
Now we edit the page HTML source adding PHP code to send a reverse shell. This is normally blocked by the application, but the filter can be bypassed as indicated in the CVE details. Make sure "Show dynamic content" and "Edit inline" are activated so the PHP code is rendered after saving.
Add a PHP reverse shell, the filter is bypassed by replacing <?php with <?PHP as indicated in the aforementioned CVE.
Click on "Save", a reverse shell for user www-data is received on port 1919.
Shells for user www-data are limited; however, this user is usually allowed to read the /var/www/html directory, where we can harvest passwords.
In the file /var/www/html/crm.board.htb/htdocs/conf/conf.php there are credentials for the MySQL database.
Maybe someone is reusing this password for his user account. Let's dump the host usernames.
And verify we can use the password to open an SSH shell for as larissa
Which can be used to retrieve the user flag.
ROOT
Start from the SSH session as larissa and take the opportunity to enumerate the user and the system.
Enumerate SUID files.
The Enlightenment binaries belongs to a window manager application, which seems to be vulnerable (https://www.cvedetails.com/cve/CVE-2022-37706).
According to the CVE description, the the system library function mishandles path names that begin with a /dev/.. sub string. There is an exploit available at https://www.exploit-db.com/exploits/51180 that you can execute it for instant root shell.
Or just try to understand what it does and run it manually. Basically, the vulnerable binary fails to handle a source file when the path begins with /dev/.. sub string. So if we inject a path called /dev/../tmp;/tmp/exploit, the application will fail to process the first part, and will just run the second part. We just need to make this second part is a malicious payload to spawn a shell.
You are root.
Last updated